3 charged in cyberattacks against U.S. finance companies

Published Nov. 10, 2015

NEW YORK — Two men held in Israel and one U.S. citizen believed to be living in Moscow have been charged in the largest theft of consumer data from a U.S. financial institution in history, according to an indictment unsealed Tuesday.

Most of the theft of personal information from more than 100 million customers came with a summer 2014 attack against JPMorgan Chase, the nation's biggest bank by assets, prosecutors in New York said.

According to the indictment, the men stole customer records of more than 83 million customers of JPMorgan Chase & Co. from June to August 2014. The court papers said identifying information on millions of other people was stolen in cyberattacks from 2012 to last summer against several other financial institutions, financial services corporations and financial news publishers.

It said one or more of the defendants also engaged in other criminal schemes since 2007, including U.S. securities market manipulation schemes and the operation of at least a dozen Internet casinos that violated U.S. laws.

The indictment said some of the massive computer hacks and cyberattacks occurred as the men sought to steal the customer base of competing Internet gambling businesses or to secretly review executives' emails in a quest to cripple their rivals.

Charged in the indictment were Gery Shalon, Ziv Orenstein and Joshua Samuel Aaron. All three men were charged in July with related crimes, though the hacking crimes were not specified then.

Authorities said Aaron, a U.S. citizen believed to be residing in Moscow and Israel, was a fugitive while Shalon of Savyon, Israel, and Orenstein of Bat Hefer, Israel, were in custody in Israel. Among charges in the indictment were computer hacking, conspiracy to commit computer hacking, securities fraud and conspiracy to commit securities fraud.